A major airline is mitigating Magecart attacks with Jscrambler’s Code Integrity solution, which provides fine-grained behavior.
If you are a cybersecurity aficionado, you have likely heard of the Magecart cybercriminal groups. They have been very active since 2018 and are known for injecting web credit card skimmers on e-commerce and payment websites, which pose a serious threat to businesses.
Note: At our clients’ request, we have anonymized all company and personal names.
Magecart: Evolved Web Skimming
In a Magecart attack, attackers inject a skimmer that can hijack form submissions containing credit card details. These details are then sent to attacker-controlled drop servers. Throughout this process, neither the end-user nor the company was aware the attack had taken place.
While we’ve seen Magecart attacks originating from compromises of first-party and third-party code, third-party attacks are especially critical because they don’t require a first-party server breach or direct access to the company’s website.
Attackers can exploit a third-party integration, such as a live chat widget, to inject the skimmer’s code without being detected.
The Key Business Threats of Magecart
Because many Magecart attacks go unnoticed by users or the affected company, they can remain active for months before being detected and taken down.
In our analysis of a sample of known attacks, skimmers remain active for an average of 104 days before being detected and taken down.
These attacks pose a significant threat to businesses. Looking back at known Magecart attacks, they have likely caused over $1 billion in direct business losses, including the $26 million GDPR fine against British Airways.
We also have to consider the potential impact of indirect business losses. Because of negative PR and a loss of customer trust following a Magecart data breach, losses in revenue can have a long-lasting impact on the business.
Behavior-Based Magecart Mitigation
New Magecart attacks emerge every week and grow more sophisticated. Companies are gradually realizing they need to think outside the firewall and protect the client side. But several security approaches commonly associated with Magecart prevention often fail to cut this new wave of sophisticated Magecart skimmers.
Some, like CSP, are often bypassable; others introduce unsustainable performance drops and cause malfunctions.
While these skimmers keep evolving their tactics, they still exhibit specific malicious behaviors. As such, a behavior-based approach to Magecart mitigation provides the best chances of detecting and blocking this malicious behavior in real time.
This is what Jscrambler Webpage Integrity delivers to E-Commerce enterprises.
Jscrambler and Major Airline: Magecart Mitigation
The Challenges
The 2018 Magecart attack on British Airways made headlines worldwide because it silently exfiltrated over 380,000 credit cards and remained active for 15 days before being detected and taken down.
After it was disclosed that BA initially faced a $230 million GDPR fine, Magecart attacks became much more noteworthy.
Companies started to look for solutions able to mitigate this type of sophisticated client-side attack, and Jscrambler was contacted by a major airline with this challenge: to prevent Magecart web skimmers from running undetected on their pages and exfiltrating data.
The company ran web apps with scripts from third parties. One key priority was knowing when one of these scripts changed behavior.
Such a change could be linked to attackers exploiting vulnerabilities in these third-party providers and injecting malicious code that could lead to a Magecart attack.
“After learning about the Magecart attack on British Airways, it became our priority to detect and prevent these attacks from happening to us.” Jscrambler client, from the Airline industry.
Fast implementation was one of this project’s biggest requirements. Each unmonitored user session could potentially hide a web skimmer, and the risk of a breach was tangible.
With the company’s complex web environment, several other requirements had to be met. For one, the company needed a solution that could integrate easily with the SIEM it was already using. It also had to guarantee minimal performance overhead, ensuring the end user’s experience wouldn’t be negatively affected.
“We had to be alerted immediately when a third-party script started doing things that it shouldn’t do.” Jscrambler client, from the Airline industry
The company also wanted to ensure the solution would work correctly even when file names changed frequently.
The Solution
Because they needed a solution that could stop potential Magecart attacks, the company tested several vendors.
“Jscrambler has merit in passing every test we threw at it and being able to thwart the web skimming scenarios that we tested.” Jscrambler client, from the Airline industry.
As such, the company put Jscrambler Webpage Integrity to the test in multiple different attack scenarios. These dozens of tests included detecting illegitimate additions, modifications, or removals of page content (DOM tampering), poisoning form events, and exfiltrating data to a drop server.
Beyond testing the raw detection and mitigation capabilities of Jscrambler, the company also highlighted the exceptional level of control that the tool provides.
Unlike most solutions, Jscrambler Webpage Integrity provides fine-grained behavior control based on both high-level assumptions and user-defined rules.
“The level of control and the ease of taking out the solution with no impact are added benefits.” Jscrambler client, from the Airline industry.
We also tested performance to understand the potential impact of adding Jscrambler to the company’s web pages. During these tests, our client found that Jscrambler could easily be taken out with zero impact, and this flexibility was very valuable in their case.
After weighing all factors, from raw capabilities to ease of integration and maintenance, the company concluded that Jscrambler outperformed all other vendors. As a result, they migrated from a PoC environment to a live production environment.
The Results
Throughout the demanding testing process, Jscrambler Webpage Integrity consistently received approval from multiple teams and committees within the company, from software development to architecture and legal.
With support from a dedicated engineering team, we delivered within this challenging timeframe. We ensured a smooth transition from POC to a live environment. During the 2-week learning process after the official kick-off, we fine-tuned Jscrambler and ensured it was ready for the battlefield.
“This solution has met our requirements, and we’re confident to deploy it in our live environment to help us prevent a Magecart breach.” Jscrambler client, from the Airline industry.
Beyond delivering a timely, robust, and flexible solution to a major airline (and receiving additional confirmation that our solution is the best choice to mitigate Magecart attacks), we’re thrilled to know millions of travelers benefit from protection against credit card skimmers and enjoy a safer online experience.
Conclusion
Magecart attacks can devastate companies, and the impact is worse when they lack visibility into what is happening.
In this case study, we saw how Jscrambler helped a major airline mitigate this threat, but our mission doesn’t stop here.
So we are offering a free inventory report to help you start preventing Magecart attacks.
